AZ-104 Manage Azure Identities and Governance Practice Question
Exhibit
Policy compliance report: - Assignment: Deny public network access on storage accounts - Scope: MG-Platform - Noncompliant resource: stlegacy01 in RG-Legacy - Business note: The legacy application must stay publicly reachable for 30 days during migration.
Based on the exhibit, what should the administrator use to temporarily allow the legacy storage account to remain noncompliant without changing the policy for everyone?
⚠ Common exam trap
Many exam-takers confuse policy exemptions with resource locks or policy definition modifications, mistakenly thinking a ReadOnly lock or moving the resource will bypass policy evaluation, when in fact only an exemption explicitly excludes a resource from policy compliance checks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a policy exemption for the legacy storage account or its resource group.
A policy exemption allows the administrator to exclude a specific resource (the legacy storage account) or its resource group from the Azure Policy evaluation without modifying the underlying policy definition. This is the correct approach because it temporarily grants noncompliance for that resource while the policy remains enforced for all other resources, aligning with the requirement to avoid changing the policy for everyone.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Modify the policy definition so all storage accounts can use public network access.
Why it's wrong here
Modifying the policy definition changes the deny effect for every scope where that definition is assigned, not just the legacy storage account. This would broadly allow public network access for all storage accounts across the environment, undermining the compliance baseline the policy was designed to enforce. Policy definitions should be treated as versioned, centrally managed artifacts; altering them to accommodate a single exception is an anti-pattern and creates audit noise, whereas a policy exemption is a scoped, documented exception that leaves the rest of the footprint governed.
When this WOULD be correct
If the question asked for a permanent solution to allow public network access for all storage accounts, or if the policy was too restrictive and needed to be relaxed globally, then modifying the policy definition would be correct.
- ✓
Create a policy exemption for the legacy storage account or its resource group.
Why this is correct
A policy exemption is designed for approved exceptions to an existing assignment. It lets the legacy storage account remain temporarily outside the deny effect while preserving the policy for everything else. This keeps governance intact and documents the exception clearly.
- ✗
Apply a ReadOnly lock to the storage account.
Why it's wrong here
A ReadOnly lock prevents any management-plane write operation, such as changing network access rules or applying tags, but it does not affect Azure Policy's compliance evaluation. Policy will still see the storage account as non-compliant because the public network access setting remains, and the deny effect will block attempts to update the resource. Locks are meant to prevent accidental deletion or modification, not to grant exceptions; this action would also interfere with legitimate future changes and does not create any explicit exemption from the policy assignment.
When this WOULD be correct
A ReadOnly lock would be correct if the question asked how to prevent accidental modifications or deletions of a critical storage account while still allowing read access, without any policy compliance requirement.
- ✗
Move the storage account to another subscription so the policy no longer applies.
Why it's wrong here
Moving the storage account to another subscription is a heavy, disruptive operation that can change the resource's canonical ID, disrupt access for clients, and may not even avoid the policy if it is assigned at a management group above both subscriptions. Even if the move succeeds, the resource is ungoverned rather than explicitly exempted, which is poor governance practice and will fail an audit that expects a documented exception. Azure Policy exemptions provide a controlled, reversible process for legacy resources, while a migration should be planned for long-term compliance instead of just relocating the problem.
When this WOULD be correct
If an organization wants to permanently exclude a resource from a policy without affecting other resources, and the policy is scoped to a specific subscription, moving the resource to a different subscription that does not have the policy assigned would be a valid solution.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a policy exemption for the legacy storage account or its resource group.Correct answer▾
Why this is correct
A policy exemption is designed for approved exceptions to an existing assignment. It lets the legacy storage account remain temporarily outside the deny effect while preserving the policy for everything else. This keeps governance intact and documents the exception clearly.
✗Modify the policy definition so all storage accounts can use public network access.Wrong answer — click to see why▾
Why this is wrong here
Modifying the policy definition to allow public network access for all storage accounts would affect everyone, not just the legacy account. The requirement is to temporarily allow only the legacy account to be noncompliant without changing the policy for others.
★ When this WOULD be the correct answer
If the question asked for a permanent solution to allow public network access for all storage accounts, or if the policy was too restrictive and needed to be relaxed globally, then modifying the policy definition would be correct.
Why candidates choose this
Candidates may think that changing the policy is the most direct way to resolve noncompliance, overlooking the need to isolate the exemption to a single resource.
✗Apply a ReadOnly lock to the storage account.Wrong answer — click to see why▾
Why this is wrong here
Applying a ReadOnly lock prevents any changes to the storage account, but it does not exempt the account from policy compliance. The policy would still evaluate the account as noncompliant because public network access remains enabled.
★ When this WOULD be the correct answer
A ReadOnly lock would be correct if the question asked how to prevent accidental modifications or deletions of a critical storage account while still allowing read access, without any policy compliance requirement.
Why candidates choose this
Candidates may confuse locks with policy exemptions, thinking that locking the resource prevents policy evaluation or enforcement, or they may believe that a lock can override policy effects.
✗Move the storage account to another subscription so the policy no longer applies.Wrong answer — click to see why▾
Why this is wrong here
Moving the storage account to another subscription would remove it from the policy's scope, but the question asks for a temporary solution without changing the policy for everyone. This approach is not temporary and could cause other compliance or management issues.
★ When this WOULD be the correct answer
If an organization wants to permanently exclude a resource from a policy without affecting other resources, and the policy is scoped to a specific subscription, moving the resource to a different subscription that does not have the policy assigned would be a valid solution.
Why candidates choose this
Candidates may think that moving the resource to another subscription is a quick way to bypass the policy, overlooking that it's not temporary and may introduce other complications like network connectivity or management overhead.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Resource group
A logical container in Microsoft Azure that holds related resources for an application or solution, enabling unified management, security, and billing.
Key term
Policy definition
A policy definition is a formal rule or set of rules that specifies allowed or denied actions on resources within an IT environment, often used for governance, compliance, and security control.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.